Executive Summary
The publication of NIST's first post-quantum cryptography (PQC) standards has accelerated enterprise discussions around cryptographic modernization. Technology vendors are introducing quantum-resistant capabilities into their product roadmaps, governments are encouraging organizations to prepare for future cryptographic transitions, and security leaders are beginning to assess the long-term implications for enterprise infrastructure.
Despite this momentum, many organizations continue to frame post-quantum readiness primarily as a technology migration challenge.
Questions surrounding algorithm selection, implementation timelines, interoperability testing, and performance optimization dominate strategic planning sessions. While these considerations are important, they represent only one dimension of enterprise preparedness.
The larger challenge is governance.
Modern enterprises depend upon cryptographic trust across identity systems, cloud platforms, customer applications, APIs, software supply chains, operational technology, and partner ecosystems. These trust relationships extend across multiple business units, technology teams, cloud providers, and third-party vendors.
Managing this complexity requires far more than technical implementation.
It requires executive ownership, cross-functional collaboration, evidence-based decision-making, supplier engagement, and continuous governance.
CyberTech Intelligence believes organizations that establish governance before technology will experience lower operational risk, stronger investment alignment, and significantly greater long-term resilience during the transition to post-quantum cryptography.
This newsletter explores why governance should become the first milestone of every enterprise PQC strategy and outlines practical actions executive leadership can take today.
Why Governance Has Become the Critical Success Factor
For decades, cybersecurity modernization followed a familiar pattern.
Organizations identified a technology challenge, selected an appropriate solution, implemented the technology, and gradually refined operational processes over time.
Post-quantum cryptography challenges this model.
Unlike deploying a new endpoint protection platform or replacing a firewall, PQC modernization affects the underlying trust mechanisms that support nearly every digital interaction within an enterprise.
Digital identities.
Secure communications.
Customer authentication.
Cloud encryption.
Software integrity.
Machine-to-machine communications.
Digital certificates.
Public Key Infrastructure (PKI).
These capabilities are distributed throughout the organization rather than owned by a single technology team.
Consequently, successful modernization depends less on selecting the right algorithm and more on ensuring the organization possesses the governance maturity required to coordinate enterprise-wide change.
CyberTech Intelligence recommends that executive teams begin by asking a different question.
Instead of asking:
"Which quantum-safe algorithms should we deploy?"
Leadership should first ask:
"Do we have the governance structures necessary to modernize enterprise cryptography without disrupting the business?"
That question shifts the discussion from implementation toward organizational capability.
Technology Evolves. Governance Endures.
One of the defining characteristics of cybersecurity is continuous change.
Over the past twenty years, organizations have modernized repeatedly in response to cloud computing, mobile technologies, Zero Trust architectures, artificial intelligence, software supply chain security, and increasingly sophisticated cyber threats.
Each transformation introduced new technologies.
However, organizations that adapted successfully typically shared one characteristic.
They possessed mature governance.
Strong governance enables organizations to:
- Prioritize investments objectively.
- Coordinate multiple stakeholders.
- Align cybersecurity with business strategy.
- Manage technology transitions consistently.
- Measure progress using executive metrics.
- Reduce operational uncertainty.
Technology inevitably changes.
Governance enables organizations to change with it.
This distinction is particularly relevant for post-quantum cryptography because standards, vendor capabilities, regulatory expectations, and enterprise architectures will continue evolving over the next decade.
Organizations that build governance capabilities today will remain better positioned regardless of how future cryptographic technologies develop.
Enterprise Cryptography Is No Longer a Security-Only Responsibility
Historically, cryptography was considered a highly specialized technical discipline managed primarily by security engineers and infrastructure teams.
That operating model is becoming increasingly outdated.
Enterprise cryptography now influences virtually every business function.
Identity teams manage authentication.
Cloud engineers oversee encryption services.
Application developers integrate cryptographic libraries.
DevSecOps teams secure software delivery pipelines.
Infrastructure teams administer certificates and PKI.
Procurement evaluates supplier capabilities.
Risk and compliance teams oversee governance obligations.
Business leaders determine operational priorities.
Executive leadership approves investment strategies.
No single department possesses complete ownership of enterprise trust.
As a result, organizations should replace isolated technical management with coordinated enterprise governance.
CyberTech Intelligence believes this organizational shift represents one of the most important and most overlooked requirements for successful post-quantum readiness.
Why Boards Must Own Digital Trust Governance
Cybersecurity has become a standing agenda item in boardrooms across every major industry. Directors routinely review ransomware preparedness, regulatory compliance, cyber resilience, cyber insurance, and business continuity planning. These discussions reflect the growing recognition that cybersecurity is no longer solely an operational concern—it is a strategic business issue.
Post-quantum cryptography extends this evolution.
Unlike an isolated security incident, the transition to quantum-resistant cryptography will unfold over several years. It requires sustained investment, coordinated decision-making, supplier engagement, and organizational discipline rather than emergency response.
This places governance squarely within the board's responsibility.
Board members are not expected to evaluate cryptographic algorithms or implementation methodologies. Their role is to ensure that management has established an effective governance framework capable of supporting long-term modernization.
CyberTech Intelligence recommends that boards regularly seek answers to questions such as:
- Do we understand where cryptographic trust exists across our business?
- Which critical services depend on legacy cryptographic implementations?
- Have executive responsibilities been clearly assigned?
- Are strategic technology suppliers aligned with our modernization objectives?
- How are investments being prioritized?
- What metrics demonstrate organizational progress?
These questions encourage leadership teams to view PQC readiness as an enterprise capability rather than a technology project.
As digital trust becomes increasingly central to customer confidence, regulatory compliance, and operational resilience, board oversight will become a competitive differentiator.
The Cost of Fragmented Ownership
One of the greatest barriers to successful cryptographic modernization is fragmented ownership.
In many organizations, responsibility for enterprise cryptography has evolved organically over time.
Infrastructure teams manage certificates.
Identity teams oversee authentication services.
Cloud engineers administer encryption platforms.
Application developers maintain embedded cryptographic libraries.
DevSecOps teams secure software signing.
Procurement negotiates supplier contracts.
Risk teams evaluate governance.
Legal departments review contractual obligations.
Each function manages a portion of the trust ecosystem.
Very few organizations, however, have established a unified governance model that connects these responsibilities.
This fragmentation creates several operational challenges.
Inconsistent Priorities
Each department naturally focuses on its own objectives.
Infrastructure teams prioritize availability.
Security teams emphasize risk reduction.
Application teams focus on development velocity.
Business leaders prioritize customer outcomes.
Without centralized governance, modernization efforts become inconsistent and difficult to coordinate.
Limited Visibility
Individual departments often possess detailed knowledge of their own environments but lack visibility into enterprise-wide dependencies.
As a result, leadership cannot accurately determine:
- Which systems present the highest business risk.
- Which suppliers require immediate engagement.
- Which modernization initiatives should receive funding first.
Incomplete visibility frequently results in delayed decision-making and inefficient resource allocation.
Duplicate Investments
Without coordinated governance, different business units may independently purchase discovery tools, certificate management platforms, consulting services, or modernization capabilities.
This duplication increases costs while producing inconsistent operational outcomes.
A centralized governance model helps organizations optimize investments across the enterprise.
Increased Operational Risk
When responsibilities are unclear, important activities can be overlooked.
Certificates expire unexpectedly.
Supplier assessments remain incomplete.
Business dependencies are not documented.
Critical applications receive insufficient attention during modernization planning.
These risks are rarely caused by inadequate technology.
More often, they result from inadequate governance.
Building a Cross-Functional Operating Model
CyberTech Intelligence recommends replacing fragmented ownership with a structured operating model that brings together technical expertise and business leadership.
A successful governance committee should include representatives from:
- Information Security
- Enterprise Architecture
- Infrastructure Operations
- Cloud Engineering
- Identity and Access Management
- Application Development
- DevSecOps
- Procurement
- Risk and Compliance
- Internal Audit
- Business Unit Leadership
- Executive Management
The purpose of this group is not to manage day-to-day technical operations.
Instead, it provides strategic oversight for enterprise cryptographic modernization.
Its responsibilities typically include:
- Defining governance policies.
- Reviewing enterprise cryptographic inventories.
- Prioritizing modernization initiatives.
- Monitoring supplier readiness.
- Evaluating investment priorities.
- Reviewing executive dashboards.
- Reporting progress to senior leadership and the board.
This collaborative model reduces organizational silos and strengthens enterprise-wide decision-making.
Executive Accountability Must Be Clearly Defined
Governance becomes effective only when accountability is explicit.
CyberTech Intelligence recommends assigning responsibilities across multiple leadership roles.
Board of Directors
The board provides strategic oversight by ensuring that quantum readiness aligns with enterprise risk management and long-term business objectives.
Key responsibilities include:
- Reviewing governance maturity.
- Monitoring strategic risks.
- Approving long-term investment direction.
- Evaluating executive progress.
Chief Information Officer (CIO)
The CIO ensures that cryptographic modernization aligns with enterprise architecture and digital transformation strategies.
Responsibilities include:
- Infrastructure modernization.
- Enterprise technology planning.
- Cross-functional coordination.
- Resource allocation.
Chief Information Security Officer (CISO)
The CISO establishes governance standards and oversees enterprise cyber risk.
Responsibilities include:
- Cryptographic governance.
- Risk prioritization.
- Security policy.
- Executive reporting.
- Readiness assessments.
Chief Technology Officer (CTO)
The CTO focuses on software architecture and technology innovation.
Responsibilities include:
- Application modernization.
- Software development standards.
- API security.
- Crypto agility within engineering practices.
Chief Risk Officer (CRO)
The CRO integrates PQC readiness into enterprise risk management.
Responsibilities include:
- Business impact assessments.
- Regulatory oversight.
- Governance reporting.
- Long-term risk evaluation.
Procurement Leadership
Suppliers will significantly influence enterprise migration timelines.
Procurement should therefore:
- Review vendor roadmaps.
- Validate support commitments.
- Monitor contractual obligations.
- Coordinate supplier engagement with technology teams.
Governance Creates Better Decisions
Strong governance does not slow innovation.
It improves decision quality.
Organizations with mature governance can answer questions such as:
- Which modernization initiative delivers the greatest business value?
- Which supplier presents the highest strategic risk?
- Which business services require immediate attention?
- How should limited budgets be allocated?
- Which KPIs demonstrate measurable progress?
These decisions become significantly easier when leadership has access to consistent governance processes and reliable enterprise data.
CyberTech Intelligence believes governance is ultimately about improving organizational confidence.
When leadership trusts the quality of available information, strategic decisions become faster, more consistent, and better aligned with business priorities.
The CyberTech Intelligence Enterprise PQC Governance Framework™
CyberTech Intelligence Perspective
Post-quantum readiness becomes operational only when leadership establishes a recurring decision cadence. One-time assessments, isolated pilots, or broad policy statements do not create durable readiness. Executives need a governance mechanism that converts visibility, supplier evidence, pilot results, budget constraints, and regulatory developments into regular decisions on sequencing, ownership, risk acceptance, and investment.
CyberTech Intelligence Research Desk Observation
The strongest governance model is not the one with the largest steering committee; it is the one that produces timely, evidence-based decisions. A useful executive cadence should surface unresolved ownership, aging evidence, supplier dependencies, blocked pilots, funding gaps, and business services with long-lived confidentiality exposure. Progress should be measured through decision quality and risk reduction, not the number of meetings held or initiatives launched.
As organizations move beyond awareness and begin planning for post-quantum cryptography (PQC), one question consistently emerges:
"What should enterprise governance actually look like?"
Many organizations already have cybersecurity committees, architecture review boards, cloud governance councils, and enterprise risk functions. While these structures provide a strong foundation, post-quantum readiness introduces unique governance requirements that extend across technology, business operations, procurement, compliance, and executive leadership.
CyberTech Intelligence recommends structuring the operating model around five interconnected governance capabilities within the CyberTech Intelligence Enterprise PQC Readiness Framework™.
Pillar 1 — Executive Leadership and Strategic Direction
Every successful transformation begins with visible executive sponsorship.
Without executive ownership, cryptographic modernization often competes with other strategic initiatives for funding, resources, and organizational attention.
Executive leadership should define:
- Strategic objectives for quantum readiness
- Business outcomes expected from modernization
- Investment priorities
- Enterprise success metrics
- Governance responsibilities
- Reporting cadence
Rather than approving isolated technology purchases, executives should ensure that PQC readiness aligns with broader digital transformation, cyber resilience, and enterprise risk strategies.
Leadership involvement signals that cryptographic modernization is an enterprise priority—not simply another IT initiative.
Pillar 2 — Enterprise Governance and Decision-Making
A recurring, accountable governance forum should serve as the primary coordination mechanism for post-quantum readiness.
CyberTech Intelligence recommends creating a recurring governance forum responsible for:
- Reviewing enterprise cryptographic inventories
- Prioritizing modernization initiatives
- Assessing business impact
- Reviewing vendor readiness
- Monitoring executive KPIs
- Resolving cross-functional dependencies
- Reporting progress to senior leadership
The committee should meet regularly and include representation from technology, security, business operations, procurement, legal, risk management, and executive leadership.
The objective is consistent enterprise-wide decision-making.
Pillar 3 — Risk-Based Prioritization
One of the biggest governance mistakes organizations make is attempting to modernize every cryptographic dependency simultaneously.
This approach rarely succeeds.
Instead, modernization priorities should be based on business risk.
CyberTech Intelligence recommends evaluating every major system according to criteria such as:
- Business criticality
- Customer impact
- Regulatory exposure
- Data confidentiality requirements
- Operational dependency
- Vendor readiness
- Technical complexity
- Recovery effort
Risk-based prioritization enables organizations to maximize resilience while using resources efficiently.
Pillar 4 — Supplier Governance
No organization modernizes alone.
Cloud providers, SaaS vendors, infrastructure partners, managed service providers, hardware manufacturers, and software suppliers all influence enterprise cryptographic readiness.
Executive governance should therefore include structured supplier engagement.
Key activities include:
- Reviewing PQC product roadmaps
- Evaluating migration guidance
- Confirming interoperability testing
- Monitoring support commitments
- Reviewing contractual obligations
- Assessing implementation timelines
Supplier governance should become a recurring executive activity rather than an occasional procurement review.
Pillar 5 — Continuous Improvement
Governance should not conclude once modernization planning has been completed.
Technology environments continue evolving.
Applications are replaced.
Cloud services expand.
Business priorities change.
New regulations emerge.
Consequently, governance should become an ongoing operating capability supported by:
- Quarterly executive reviews
- Annual strategy refreshes
- Continuous inventory updates
- Vendor reassessments
- Business impact reviews
- Governance maturity assessments
Organizations that embrace continuous governance remain significantly more adaptable than those relying on periodic modernization projects.
Executive KPIs That Should Appear on Every Board Dashboard
Cybersecurity reporting has traditionally focused on operational indicators.
Examples include:
- Critical vulnerabilities
- Malware detections
- Patch compliance
- Security incidents
- Mean Time to Detect (MTTD)
- Mean Time to Respond (MTTR)
While valuable, these metrics do not provide sufficient insight into post-quantum readiness.
CyberTech Intelligence recommends supplementing traditional cybersecurity reporting with governance-focused executive KPIs.
Governance KPIs
Leadership should monitor:
- Executive sponsorship established
- Governance committee participation
- Business units represented
- Governance actions completed
- Strategic decisions implemented
These indicators demonstrate organizational engagement rather than technical activity.
Visibility KPIs
Executive dashboards should also include:
- Enterprise cryptographic inventory completion
- Business applications assessed
- Critical systems mapped
- Long-lived sensitive data identified
- Certificate inventory coverage
These metrics indicate how well the organization understands its trust infrastructure.
Modernization KPIs
Progress toward future readiness can be measured using:
- High-priority systems evaluated
- Vendor readiness assessments completed
- Crypto agility initiatives underway
- PKI modernization milestones achieved
- Legacy cryptographic dependencies identified
These metrics help leadership understand where modernization efforts are progressing and where additional attention is required.
Supplier KPIs
Because enterprise trust increasingly depends on external partners, organizations should monitor:
- Strategic suppliers reviewed
- Vendors with published PQC roadmaps
- Product interoperability validated
- Migration support confirmed
- Contractual readiness completed
Supplier metrics often provide early indicators of enterprise modernization readiness.
Business KPIs
Finally, governance should connect technical progress with measurable business outcomes.
Examples include:
- Critical business services prioritized
- Revenue-generating applications assessed
- Customer-facing systems reviewed
- Operational resilience improvements
- Executive confidence in modernization planning
These indicators ensure that cryptographic governance remains aligned with enterprise strategy rather than becoming an isolated technical exercise.
A Practical 12-Month Governance Roadmap
Organizations frequently ask whether governance should begin after cryptographic discovery.
CyberTech Intelligence recommends the opposite.
Governance should begin immediately.
Months 1–3: Establish Leadership
During the first quarter, organizations should:
- Appoint an executive sponsor.
- Define governance objectives.
- Form a cross-functional governance committee.
- Identify reporting requirements.
- Establish executive meeting schedules.
The focus should be on creating organizational alignment before technical planning begins.
Months 4–6: Build Enterprise Visibility
Leadership should then oversee:
- Enterprise cryptographic discovery
- Business service mapping
- Certificate inventories
- PKI documentation
- Vendor inventories
- Ownership assignments
By the end of this phase, organizations should possess a reliable understanding of their trust infrastructure.
Months 7–9: Prioritize Modernization
Using information collected during discovery, leadership should:
- Evaluate business impact.
- Rank modernization priorities.
- Review supplier readiness.
- Estimate investment requirements.
- Approve phased implementation strategies.
Decisions should be evidence-based rather than assumption-driven.
Months 10–12: Institutionalize Governance
During the final quarter, organizations should transition from planning to continuous governance.
Activities include:
- Publishing executive dashboards.
- Scheduling recurring board updates.
- Updating enterprise inventories.
- Monitoring supplier progress.
- Reviewing governance effectiveness.
- Integrating PQC oversight into broader cybersecurity governance.
By the end of the first year, organizations should possess an executive operating model capable of supporting long-term cryptographic modernization.
Governance Accelerates Change; It Does Not Delay It
A common misconception is that governance introduces unnecessary bureaucracy.
CyberTech Intelligence's research suggests the opposite.
Organizations with mature governance typically:
- Make investment decisions more quickly.
- Reduce duplication of effort.
- Improve supplier coordination.
- Strengthen executive alignment.
- Minimize operational disruption.
- Respond more effectively to evolving standards.
Governance reduces uncertainty.
Reduced uncertainty accelerates execution.
This is particularly important for post-quantum cryptography, where modernization programs will span multiple years and involve numerous internal and external stakeholders.
Organizations that invest in governance early will spend less time resolving organizational challenges later.
CyberTech Intelligence Executive Perspective
Governance Is the Competitive Advantage in the Quantum Era
Every major cybersecurity transformation has produced a defining lesson.
When organizations focus exclusively on technology, they often underestimate the organizational change required to support it. When they focus first on governance, technology adoption becomes more structured, predictable, and sustainable.
Post-quantum cryptography presents another opportunity to apply that lesson.
Although much of the current industry conversation focuses on algorithms, migration tools, and product roadmaps, executive leadership should recognize that technology alone will not determine enterprise readiness.
Organizations that successfully navigate the quantum transition will distinguish themselves through governance.
They will understand their trust infrastructure before attempting to modernize it.
They will align cybersecurity strategy with business priorities.
They will establish clear ownership across departments.
They will engage technology partners proactively.
Most importantly, they will create governance models capable of adapting continuously as standards, regulations, and enterprise technologies evolve.
CyberTech Intelligence believes this governance-first approach delivers benefits extending well beyond post-quantum cryptography.
The same executive operating model strengthens cloud transformation, software supply chain security, AI governance, digital identity modernization, and cyber resilience initiatives.
In this context, PQC becomes more than a cryptographic transition.
It becomes an opportunity to improve how organizations make strategic cybersecurity decisions.
Five Strategic Recommendations for Executive Leadership
1. Establish Governance Before Launching Technical Projects
Many organizations begin by evaluating technology solutions.
CyberTech Intelligence recommends beginning with governance.
Executive teams should first establish:
- Executive sponsorship
- Governance committee structure
- Business objectives
- Reporting cadence
- Decision-making authority
- Success metrics
Technology implementation should support governance—not replace it.
Organizations that define governance first typically experience fewer project delays and stronger executive alignment throughout modernization.
2. Make Digital Trust a Board-Level Discussion
Digital trust has become a business capability.
It directly influences:
- Customer confidence
- Brand reputation
- Revenue-generating digital services
- Regulatory compliance
- Operational resilience
- Strategic partnerships
Board discussions should therefore evolve beyond cybersecurity incidents and include long-term trust governance.
Leadership should regularly review:
- Enterprise cryptographic maturity
- Governance effectiveness
- Supplier readiness
- Strategic modernization priorities
- Business risk exposure
- Investment progress
Board engagement reinforces organizational accountability and ensures modernization remains aligned with enterprise strategy.
3. Strengthen Cross-Functional Collaboration
No single department owns enterprise cryptography.
Successful organizations recognize that digital trust depends on collaboration among multiple stakeholders.
CyberTech Intelligence recommends formalizing recurring collaboration between:
- Information Security
- Enterprise Architecture
- Infrastructure Operations
- Cloud Engineering
- Identity and Access Management
- DevSecOps
- Procurement
- Risk and Compliance
- Internal Audit
- Business Leadership
Shared governance reduces organizational silos and improves enterprise-wide decision-making.
4. Treat Vendor Governance as a Strategic Capability
Technology providers will significantly influence enterprise readiness over the next decade.
Organizations should move beyond annual procurement reviews and establish continuous supplier governance.
Executive leadership should expect strategic vendors to provide:
- Transparent PQC product roadmaps
- Standards alignment documentation
- Migration guidance
- Interoperability testing results
- Customer enablement resources
- Long-term lifecycle commitments
Supplier governance should become a recurring executive responsibility because enterprise resilience increasingly depends on the maturity of external technology ecosystems.
5. Build Governance That Can Adapt
The transition to post-quantum cryptography is unlikely to be the final major cybersecurity transformation organizations will experience.
Artificial intelligence, machine identity, decentralized architectures, software supply chain security, confidential computing, and future cryptographic innovations will introduce additional governance challenges.
Organizations should therefore avoid creating governance models designed exclusively for PQC.
Instead, they should establish governance capabilities that support continuous adaptation.
The most resilient organizations are those capable of responding efficiently to change rather than predicting every future technology trend.
The Future of Enterprise Cybersecurity Leadership
Over the coming decade, executive cybersecurity leadership will increasingly be measured by organizational adaptability rather than technical specialization.
Future leaders will need to coordinate:
- Business strategy
- Enterprise architecture
- Technology modernization
- Regulatory compliance
- Vendor ecosystems
- Operational resilience
- Digital trust governance
Post-quantum readiness provides an opportunity to develop these capabilities before they become operational necessities.
Organizations that embrace this broader perspective will strengthen not only their cryptographic resilience but also their overall cybersecurity maturity.
CyberTech Intelligence expects governance maturity to become one of the strongest indicators of long-term cyber resilience.
As technology environments become increasingly interconnected, governance—not infrastructure complexity—will determine how effectively organizations respond to future change.
Executive Takeaway
The quantum era will not begin on a single date.
There will be no universal migration deadline and no single technology deployment that immediately completes enterprise readiness.
Instead, organizations will progress through years of assessment, planning, supplier engagement, governance refinement, and phased modernization.
Leadership therefore has an opportunity to prepare before urgency becomes necessity.
CyberTech Intelligence recommends focusing on three foundational questions:
- Do we understand where digital trust exists across our enterprise?
- Have we established governance capable of coordinating long-term modernization?
- Can our organization continuously adapt as technology evolves?
Organizations capable of answering yes to these questions are likely to experience smoother modernization, stronger executive confidence, and lower operational risk throughout the transition to post-quantum cryptography.
Ultimately, the objective is not simply deploying quantum-resistant algorithms.
It is building an organization capable of governing digital trust for the next decade and beyond.
Ready to Strengthen Your Enterprise PQC Governance?
CyberTech Intelligence helps enterprise organizations establish the governance, visibility, and strategic operating models required for successful post-quantum readiness.
Our Enterprise PQC Governance Assessment provides executive teams with a structured evaluation of:
- Governance maturity
- Executive accountability
- Enterprise cryptographic visibility
- Public Key Infrastructure (PKI) oversight
- Cross-functional operating models
- Supplier governance
- Crypto agility readiness
- Risk-based modernization planning
The assessment delivers practical recommendations that help organizations strengthen governance before large-scale modernization begins, enabling more confident investment decisions and reducing long-term implementation risk.
Contact CyberTech Intelligence to learn how our research-driven advisory services can help your organization build a governance-first approach to post-quantum readiness.
References
- National Institute of Standards and Technology (NIST). Post-Quantum Cryptography Project.
https://csrc.nist.gov/projects/post-quantum-cryptography - NIST. FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM).
https://csrc.nist.gov/pubs/fips/203/final - NIST. FIPS 204: Module-Lattice-Based Digital Signature Standard (ML-DSA).
https://csrc.nist.gov/pubs/fips/204/final - NIST. FIPS 205: Stateless Hash-Based Digital Signature Standard (SLH-DSA).
https://csrc.nist.gov/pubs/fips/205/final - National Cybersecurity Center of Excellence (NCCoE). Migration to Post-Quantum Cryptography Project.
https://www.nccoe.nist.gov/applied-cryptography/migration-to-pqc - Cybersecurity and Infrastructure Security Agency (CISA). Post-Quantum Cryptography Resources.
https://www.cisa.gov/topics/cybersecurity-best-practices/post-quantum-cryptography - NIST. Considerations for Achieving Crypto Agility: Strategies and Practices (CSWP 39).
https://csrc.nist.gov/pubs/cswp/39/final
